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METHOD FOR MANIPULATION IDENTIFICATION ON A SENSOR 

The invention relates to a method for identification of 
manipulation to an arrangement comprising a sensor which emits 
5 pulses and a recording unit. 

Particularly in the field of operating data recording for a 
commercial vehicle by means of a tachograph, it is essential to 
avoid manipulation on the basis of the original character of 

10 the recordings. In addition to the relevance of these 
recordings as evidence in legal disputes, the safety of the 
vehicle operation and labor- law aspects are also important 
here. With the new generation of digital tachographs in 
accordance with EU Order EU-VO 3821/85, these appliances are 

15 being developed against the requirement to reliably prevent 
manipulation of this new technology. One obvious method for 
deceitful manipulation of the recordings is the capability to 
modify, for example electromagnet ically, the signal from a 
sensor which is generally fitted in the transmission area of 

20 the motor vehicle. For example, if the regularly pulsed signals 
from the sensor which are transmitted in real time could be 
delayed thus resulting in the recorded speed always being 
slower than the speed of travel . 

•w 

2 5 One object of the invention is thus to make it harder to 
manipulate the transmission of a signal which is correlated 
with the distance traveled and/or with the speed from a sensor 
which emits pulses to a recording unit. 

30 The invention proposes a method as claimed in claim 1 in order 
to achieve the object. The dependent claims contain 
advantageous developments of the method according to the 
invention . 
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The method according to the invention is used particularly 
advantageously for personnel -related recording of data relating 
to the operation of a motor vehicle, when the recording unit is 
in the form of a tachograph and the sensor which emits pulses 
5 transmits a signal which is unambiguously correlated with the 
distance traveled by the vehicle to the recording unit or to 
the tachograph, since this application is subject to 
particularly stringent requirements for manipulation security . 
The sensor which emits pulses is in this case advantageously in 

10 the form of a Hall probe and interacts with a rotating 
transmission component which has projections and cutouts 
alternately, and in this way, the permeability in the vicinity 
of the Hall probe measurably changes a pulsed signal, 
preferably an approximately square-wave signal. The sensor 

15 accordingly transmits to the recording unit real time pulses 
whose period duration is unambiguously correlated with the 
rotation frequency of the corresponding transmission component, 
and is unambiguously correlated with the vehicle speed and the 
distance traveled. The method according to the invention 

2 0 achieves excellent manipulation security in that the 
measurement results of the sensor measurement are transmitted 
to the recording unit both as real time pulses and as data 
signals. For this purpose, the sensor has a corresponding 
evaluation unit which translates the real time pulses into data 

2 5 signals with more information content, and which are then 
transmitted to the recording unit in parallel with the real 
time pulses. According to the invention, such transmission is 
initiated by the recording unit, in particular by a data 
evaluation module in the recording unit, by means of a first 

30 request instruction, to which the sensor responds with the data 
signal. Because of the cyclic transmission of the first request 
instruction to the sensor, the data signal evaluation module in 
the recording unit can complete the measurement of the sensor 
by means of the data signals without any gaps. The real time 

35 pulses which are transmitted from the sensor to the recording 
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unit in parallel with the data signal are received by the 
recording unit by means of a real time signal interface, and 
the number of these pulses is added to form a number of real 
time pulses. The data signal evaluation module uses a second 
5 request instruction to request the number of real time pulses 
from the real time signal interface at cyclic intervals, and 
compares the difference between the number of real time pulses 
relating to the current request to that of the previous request 
for the number of pulses, which the data signal evaluation 
10 determined from the cyclically transmitted data signals for the 
same time period. 

The data signal evaluation module thus always compares the 
numbers of real time pulses associated with the correct time 
interval for measurement with corresponding numbers of data 
signal pulses, and in order to ensure that there is no 
incorrect association during this process, the first request 
instruction and the second request instruction are transmitted 
offset by a specific time interval At. This time interval At is 
matched to the cycle of the first request instructions and of 
the time difference in the signal transmission between the real 
time signal on the one hand and the real time pulses and the 
data signal . 

25 The method according to the invention is particularly 
advantageous when the cyclic transmission of the data signal 
from the sensor to the recording unit takes place at regular 
time intervals, in particular at one-minute intervals. 
Approximately one -minute intervals have been found to be 

3 0 particularly advantageous since, particularly when using the 
method according to the invention for the recording function of 
a tachograph, with software in which the method is implemented 
being configured in a modular form in layers, the software 
modules can reliably complete one cycle during this time 

3 5 between the interfaces and the evaluation with respect to the 
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processing and transmission of the real time signals and of the 
data signals . 

A layered structure of the method according to the invention 
5 and a corresponding implementation in such a manner that data 
signal evaluation is arranged in a layer which produces, 
receives and processes raw data, result in major advantages in 
the implementation and in the event of changes, with a second 
layer, which communicates with the first layer, looking after 

10 the transfer of data in such a way that data is transformed 
conf ormally in accordance with data transmission protocols , or 
is additionally also scrambled. A third layer, which 
communicates with the second layer, comprising, by way of 
example, a serial data interface and a real time signal 

15 interface, in this case expediently addresses a processor 
register and generates processor interrupts for processing of 
data streams. One component of the second layer is expediently 
a transfer module, which transforms the data signals from the 
data signal evaluation module to a form which is matched to the 

2 0 data transmission protocol, and accordingly transforms received 
data signals which conform with the protocol from the sensor to 
the recording unit back, for internal further processing in the 
recording unit . 

2 5 In order to prevent any manipulation, it is worthwhile for the 

recording unit to transmit the data signals to the sensor and 
for the sensor to transmit them to the recording unit in a 
scrambled form, and for a transfer module to be a component of 
the recording unit, which transfer module scrambles and 

3 0 descrambles data signals from the recording unit to the sensor 

and from the sensor to the recording unit, respectively. Real 
time pulses can expediently be transmitted from the sensor to a 
real time signal evaluation module essentially independently of 
this, without scrambling and without conforming with a data 
35 transmission protocol. 
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The real time signal evaluation module which converts real time 
pulses (which have been transmitted from the real time signal 
point) in particular to information about speed when using the 
5 method for a tachograph, is advantageously connected for 
signaling purposes to the data signal evaluation module, to 
which the results of this evaluation are transmitted as a 
second data signal. Such transmission and communication between 
the real time signal evaluation module and the data signal 
10 evaluation module expediently take place asynchronously by 
means of a communication memory which is arranged between the 
two modules . 

In practice, it has been found to be worthwhile for the time 
15 interval between the first request instruction and the second 
request instruction to have a length of between 50 ms and 
300 ms . A time interval of between 147 ms and 172 ms allows the 
best stability to be achieved for the method according to the 
invention, as well as minimal susceptibility to faults, so that 
20 the data signal evaluation always associates the number of real 
time pulses with a correct number of data signal pulses, and 
arrives at the correct comparison results. 

In consequence, the invention will be explained in more detail 
25 using one specific exemplary embodiment and with reference to a 
drawing for illustrative purposes, in which: 

Figure 1 shows a schematic illustration of the method 

according to the invention. 

30 

Figure 1 shows an arrangement comprising a tachograph DTCO and 
a sensor S. The tachograph DTCO is connected to the sensor S by 
means of a real time signal line RTL and a data line DL. Major 
components of the tachograph DTCO are a serial data signal 
35 interface DSI, a transfer module TM, a data signal evaluation 
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module DSE , a communication memory KM, a real time signal 
evaluation module RTSE and a real time signal interface RTI . 
The tachograph DTCO in this case carries out the function of a 
recording unit RM, according to the invention. 
5 At the start of a signal transmission process, the tachograph 
DTCO sends authentication data 70 to the sensor S, initiated by 
the data signal evaluation DSE, followed by a response request 
80. After successful authentication by both parties and the 
interchange of a session key, the tachograph DTCO and the 

10 sensor S start to transmit data related to the operation of the 
commercial vehicle, in accordance with ISO 16844-3. Every 
minute, the data signal evaluation module DSE uses a first 
request instruction 1.0 to initiate transmission of the 
measurement results from the sensor for the intermediate period 

15 as a data signal DS to the data signal evaluation module DSE. 
During this process, the method according to the invention 
operates in accordance with a layered implementation in such a 
way that the data signal evaluation module DSE transmits and 
receives the first request 1.0 and the data signal DS in the 

2 0 form of raw data, since the real time signal" evaluation module 
RTSE, the communication memory KM and the data signal 
evaluation DSE are associated with a first layer l.L. 

First request instruction 1.0 is passed as raw data from the 
2 5 data signal evaluation module DSE to the transfer module TM, 
which is associated with the second layer 2.L. As an element in 
the second layer 2.L, the transfer module TM transforms the 
first request instruction 1.0 to a form in accordance with a 
data transmission protocol DSP. 

30 

The data signals which conform with the protocol are also 
scrambled by the transfer module TM, and are passed to an 
element in a third layer 3.L for implementat ion of the method 
according to the invention, specifically to the data signal 
35 interface DSI . The third layer 3.L addresses a process register 
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at the lowermost level and generates interrupts in particular 
for the data interchange with the sensor S. The first request 
instruction is in this way passed via the data signal interface 
DSI by means of the data line DL to the sensor S. A 
5 corresponding path in the reverse direction with essentially 
inverse processes is used to take the data signal DS emitted 
from the sensor to the data signal evaluation module DSE. 

Essentially independently of the processes D which are 
10 associated with the data signal DS and, illustrated 
schematically, are located on a side D, which is annotated D, 
of a boundary line G, processes which are associated with real 
time pulses RTS take place on the side RT, which is annotated 
RT, at the same time beyond this boundary line G. The sensor S 
15 uses the real time signal line RTL to send real time pulses RTS 
to the real time signal interface RTI . 

The real time signal interface RTI, which is located in the 
third layer 3.L, transmits corresponding signals RTS to the 
2 0 real time signal evaluation module RTSE, with the number of 
real time signals RTS being continuously added to the number of 
real time pulses RTSN. 

The data signal evaluation module DSE sends a second request 
25 instruction 2.0 to the real time signal interface RTI, with the 
interposition of the transfer module TM delayed by a specific 
time interval At with respect to the first request instruction 
1.0, specifically by about 147 ms to 172 ms, matched to the 
processes, which take place in the second layer 2.L and in the 
30 third layer 3.L, for transmission of the data signal DS and of 
the first request instruction 1.0, respectively. The real time 
signal interface RTI transmits the number of real time pulses 
RTSN directly to the data signal evaluation module DSE with a 
corresponding time offset with respect to the arrival of the 
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data signal DS from the sensor S in the data signal evaluation 
module DSE . 

The data signal evaluation module DSE and the real time signal 
5 evaluation module RTSE interchange data asynchronously by means 
of the communication memory KM. The data signal evaluation 
module DSE compares the number of real time pulses RTSN with 
the number of data signal pulses DSN and, if there is a 
discrepancy between these two values that is greater than a 
10 specific no longer tolerable amount, sets a fault flag FF in 

c 

the communication memory KM, and this fault flag FF is read 
there by the real time signal evaluation module RTSE. In this 
case, the fault flag FF is used as an indicator of manipulation 
and is passed to a recording memory R. At the same time, 
15 instead of the real time pulses RTS , the real time signal 
evaluation module RTSE receives the information from the data 
signal DS for determination of the distance traveled by the 
commercial vehicle . 

20 A discrepancy which is defined as a limit is permissible in the 
comparison of the number of real time pulses RTSN and the 
number of data signal pulses DSN, and the fault flag FF is set 
if this discrepancy is exceeded. 

2 5 Depending on the real time pulses RTS, the real time signal 

evaluation module RTSE transmits a motion signal V or a stop 
signal ST to the data signal evaluation module DSE. 

If the real time signal evaluation module RTSE transmits the 

3 0 stop signal ST to the data signal evaluation module DSE, the 

data signal evaluation module DSE signals that the vehicle is 
stationary. 

If the real time evaluation module RTSE does not transmit any 
35 signal V to the data signal evaluation module DSE in a 
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situation in which the real time signal evaluation module RTSE 
identifies the "stop" state, and the real time signal interface 
RTI supplies an excessively low number of real time pulses 
RTSN = 0 in comparison to the number, of data signal pulses DSN, 
5 the fault flag FF is set and the distance traveled, as 
determined from the data signal, is used as the basis for 
recording, and the state is confirmed that the connection by 
means of the real time signal line RTL is faulty. 

10 If the real time signal evaluation module RTSE transmits a 
signal V to the data signal evaluation module DSE in a 
situation in which the real time signal evaluation module RTSE 
identifies the "drive" state, and the real time signal 
interface RTI produces an excessively low number of real time 

15 pulses RTSN in comparison to the number of data signal pulses 
DSN, the fault flag FF is set and the distance traveled or 
speed of travel as determined from the data signal DS is used 
as the basis for recording. 

20 If the data signal DS is completely absent for the purposes of 

the cyclic request instructions 1.0, the fault flag FF is 

likewise set and the state is confirmed that the connection by 
means of the data line DL is faulty. 
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